8 ms·

Show HN: Tesseral – Open-Source Auth

193 points by ucarion 1y ago

Hi folks! I'm Ulysse, and Tesseral (https://github.com/tesseral-labs/tesseral https://github.com/tesseral-labs/tesseral) is open-source auth for B2B SaaS. Early in my career, I worked on enterprise auth and security features at Segment. I've been obsessed with the subtle details of enterprise software ever since. For example, I wrote an implementation of SAML in the early days of the COVID pandemic because I thought it was fun. Over the years, I've felt frustrated that too few people have seemed interested in making auth obvious for developers of business software. Auth really doesn't need to be so confusing. We made Tesseral to help software engineers get B2B auth exactly right – and focus their energy on building the features that users want. You can use Tesseral to stand up a login page, authenticate your users, and manage their access to resources. Think of it like Auth0 or Clerk, but open source and built specifically for B2B apps. Among other things, that means that it’s designed for B2B multi-tenancy and includes enterprise-ready features like single sign-on (SAML SSO), multi-factor authentication (MFA), SCIM provisioning, and role-based access control (RBAC). For those who expose public APIs, you can use Tesseral to manage API keys for your customers. You can even limit the scope of API keys to specific actions by using our RBAC feature. We've taken care to make Tesseral powerful and secure enough to power real enterprise software but still leave it simple enough for any software developer to use. You don't have to be a security expert to implement Tesseral. (By default, therefore, Tesseral imposes a few opinions. Let us know if you have a good reason to do something unusual, and we'll work something out.) If you want to experiment with Tesseral, you can host it yourself or use our hosted service. The hosted service lives at https://console.tesseral.com https://console.tesseral.com. You can find documentation here: https://tesseral.com/docs https://tesseral.com/docs. Here are a few simple demos: https://www.youtube.com/watch?v=IhYPzz3vB54 https://www.youtube.com/watch?v=IhYPzz3vB54 https://www.youtube.com/watch?v=t-JJ8TNjqNU https://www.youtube.com/watch?v=t-JJ8TNjqNU https://www.youtube.com/watch?v=mwthBIRZO8k https://www.youtube.com/watch?v=mwthBIRZO8k We're in the early stages of the project, so we still have some gaps. We have more features, bug fixes, SDKs, and documentation on the way. What have we missed? What can we do better? We're eager to hear from the community!

macmac 1y ago
This looks neat, unfortunately the dependency on AWS is a show stopper for many European companies these days.
- themanmaran 1y ago
  Why is that? AWS has availability zones all around the globe, and 8 across the EU.
  - turblety 1y ago
    Unfortunately AWS across the EU are still subsidiaries of an American corporation and therefore subject to the CLOUD Act, which allows US authorities to compel access to data stored by American companies anywhere in the world, including their European subsidiaries. This creates a direct conflict with GDPR's data protection requirements and EU digital sovereignty principles.
    - growthwtf 1y ago
      I wasn't aware either. Is GCP and Azure similarly viewed in the EU? You run out of cloud providers pretty quickly.
      - jsiepkes 1y ago
        Definitely. In a lot of companies (especially in Germany) management is looking how they can reduce their dependency on US clouds. For example by moving to something like Scaleway, the LIDL (Schwarz digits) cloud, etc. Getting deeper into US clouds is not something which aligns with the "goal on the horizon" of most managements.
      - e1g 1y ago
        +1 to this concern from our Very Large customers in the EU. Today, AWS, GCP, etc. are omnipresent, so there are plenty of counterexamples; however, the growing concern is, "How do we become less reliant on AWS in the next decade?" There is no answer to that today, but this adds growing friction for any USA-based B2B vendors who implicitly say "we will increase your ties to the USA forever". This concern about hyperscalers predates recent counter-USA movements, and feels like a one-way road.

193 points by ucarion 1y ago

macmac 1y ago

This looks neat, unfortunately the dependency on AWS is a show stopper for many European companies these days.

themanmaran 1y ago
Why is that? AWS has availability zones all around the globe, and 8 across the EU.
- turblety 1y ago
  Unfortunately AWS across the EU are still subsidiaries of an American corporation and therefore subject to the CLOUD Act, which allows US authorities to compel access to data stored by American companies anywhere in the world, including their European subsidiaries. This creates a direct conflict with GDPR's data protection requirements and EU digital sovereignty principles.
  - growthwtf 1y ago
    I wasn't aware either. Is GCP and Azure similarly viewed in the EU? You run out of cloud providers pretty quickly.
    - jsiepkes 1y ago
      Definitely. In a lot of companies (especially in Germany) management is looking how they can reduce their dependency on US clouds. For example by moving to something like Scaleway, the LIDL (Schwarz digits) cloud, etc. Getting deeper into US clouds is not something which aligns with the "goal on the horizon" of most managements.
    - e1g 1y ago
      +1 to this concern from our Very Large customers in the EU. Today, AWS, GCP, etc. are omnipresent, so there are plenty of counterexamples; however, the growing concern is, "How do we become less reliant on AWS in the next decade?" There is no answer to that today, but this adds growing friction for any USA-based B2B vendors who implicitly say "we will increase your ties to the USA forever". This concern about hyperscalers predates recent counter-USA movements, and feels like a one-way road.